NIS2 – who does the KSC Act apply to? How to check whether your company is an essential or important entity

NIS2 is an EU directive on cybersecurity. A directive does not apply to companies directly – the obligations come from national law. In Poland it is implemented by the amended National Cybersecurity System Act (the KSC Act, also abbreviated UoKSC), which has been in force since 3 April 2026.

The new rules have replaced the old category of “operators of essential services”. There are now two categories: essential entities and important entities. Both have the same core obligations regarding risk management, incident reporting and management board accountability.

The most important practical change is that nobody will identify your company in advance. The company itself checks whether it meets the conditions and applies for entry in the register kept by the minister responsible for digital affairs. However, the authority can also enter a company in the register on its own initiative, or designate it as an essential or important entity by decision.

The Act has two annexes listing sectors. Annex 1 covers essential sectors and Annex 2 important sectors. Each sector has subsectors and a description of the type of entity, so what counts is the specific activity, not the industry in general.

A few examples often come as a surprise. Road transport in Annex 1 covers road authorities and providers of intelligent transport systems, not ordinary haulage companies. Manufacturing in Annex 2 covers only selected divisions, including medical devices, electronics, electrical equipment, machinery and vehicles, not all of manufacturing.

The table below shows the main sectors. The full list, with entity types and references to business activity codes, is in the annexes to the Act published in the Journal of Laws.

The Act refers to the EU definition of small and medium-sized enterprises. What counts is not just headcount, but also turnover and balance-sheet total. The position is assessed as at the date the financial statements are prepared.

A company stops being small when it has at least 50 employees, or when both its annual turnover and its balance-sheet total exceed EUR 10 million. Headcount is measured in annual work units, meaning full-time equivalents over the year.

An example shows why it is worth checking both financial measures. Take a hypothetical company with 40 employees, turnover of EUR 12 million and a balance-sheet total of EUR 5 million. Turnover exceeds EUR 10 million but the balance sheet does not, so the company remains small and, as a rule, does not fall under the Act.

When assessing size, you add in the figures of linked and partner enterprises, meaning companies you control, companies that control you, or companies in which you hold a significant stake. A company with 30 employees in a group of 300 people may therefore formally exceed the threshold for a large company.

The Polish Act provides an important exception here (Article 5(6) and (7)). It applies to a company that exceeds the threshold only because of the group’s figures. If its information system is independent of the systems of the other group companies, or it does not provide services jointly with them, it is neither an essential nor an important entity.

The sector condition always applies. A company in a large group that does not operate in any sector listed in the annexes does not fall under the Act simply because of the group’s size. If the group shares IT systems, it is worth confirming the assessment with a lawyer.

The category is determined by the combination of sector and size. We have summarised the basic rules in the table below. If a company meets the conditions for both categories, it is an essential entity.

Both categories have the same core obligations: an information security management system, incident reporting and management board accountability. They differ in supervision and in the level of fines. An essential entity can be inspected at any time and undergoes mandatory audits, while an important entity is inspected mainly after a report of irregularities.

The maximum fines are EUR 10 million or 2% of revenue for an essential entity, and EUR 7 million or 1.4% of revenue for an important entity. Fines can only be imposed from 3 April 2028, and the head of the entity, usually the management board, can be penalised personally. We describe the details in a separate article on fines.

Some entities are covered by the Act regardless of their size, or even as small companies. If you carry out any of the activities below, check your position particularly carefully.

The competent cybersecurity authority can also designate a smaller company from a sector in the annexes as an essential or important entity by decision. This happens, for example, when it is the only provider of a service that matters to the region, or when its failure would threaten public safety.

The examples below are hypothetical and simplified. They show the reasoning, not a ready-made legal opinion for any particular company.

A manufacturer of agricultural machinery with 120 employees. Machinery manufacturing is in Annex 2, and the company is mid-sized. It is an important entity, regardless of whether its customers are in Poland or abroad.

An IT company with 60 employees that administers customers’ servers and networks under ongoing contracts. It is a managed service provider in the ICT service management sector in Annex 1. As a mid-sized company it is an important entity, but if it also ran security monitoring for its customers, it would be an essential entity.

A transport company with 200 employees that carries goods by lorry. Ordinary road haulage is not in the annexes, so as a rule the company does not fall under the Act. However, it may receive security requirements from customers who do.

The deadline for applying for entry in the register, for companies that met the conditions on the day the Act came into force, passed on 3 October 2026. If your company missed it, apply without delay through the online system of the minister responsible for digital affairs. The application includes a statement by the head of the entity, so prepare it together with the management board.

Fines under the Act can be imposed for the first time only after 3 April 2028. That is no reason to delay. The authority can inspect companies, issue warnings and give orders before then, and the obligations must be met by the deadlines listed below.

Essential and important entities must ensure the security and continuity of the supply chain for the IT products and services their operations depend on. This follows directly from Article 8 of the Act. In practice it means security questionnaires, contract clauses and the right to audit suppliers.

This most often affects companies that supply software, IT services, system maintenance and remote access to a customer’s infrastructure. If your customer is a hospital, an energy operator or a manufacturer from Annex 2, expect questions like these.

A well-prepared company has written security rules, multi-factor authentication for key systems, backups with tested restores and a procedure for reporting incidents to customers. The same elements will be useful if the company grows and falls under the Act itself.